Support additive trust anchors in portable verification

[nurfed1]

Problem

Portable trust verification automatically uses the Microsoft AuthRoot source when
no explicit anchors are supplied.

The existing --trusted-ca and --anchor-dir options intentionally replace that
automatic trust source. This makes it awkward to trust an additional
profile-specific, private, or test CA while retaining the normal Microsoft roots.
Callers currently have to replace or reconstruct the complete trust set.

Change

Add a repeatable --additional-trusted-ca <PATH> option to the shared portable
trust-verification arguments.

The new option:

• augments the selected trust set instead of replacing it;
• preserves automatic AuthRoot discovery when used by itself;
• combines with explicit --trusted-ca, --anchor-dir, or --authroot-cab
  inputs;
• is available consistently across the portable trust-verification commands;
• accepts the same PEM or DER certificate inputs as --trusted-ca.

Existing --trusted-ca and --anchor-dir replacement behavior is unchanged.

Documentation and the CLI capability matrix are updated to describe the
distinction between replacing and additive anchors.

Validation

Added focused tests covering:

• automatic AuthRoot selection with additive anchors;
• replacement behavior when explicit anchors are present;
• repeatable argument parsing;
• deterministic merging of trusted and additional CA files.

The full fork CI matrix passes, including Unix portable checks, feature-specific
CLI tests, clippy, formatting, .NET tool packaging, and PowerShell module tests.

The behavior was also integration-tested with an Azure Artifact Signing test
profile: its authenticated profile root was added to the automatic Microsoft
AuthRoot set and the resulting signed PE chain verified successfully.